Attachment B Draft RFQ 20156753 SOW - Electronic Fingerprint Services .pdf

U.S. Department of Homeland Security

U.S. Customs and Border Protection

STATEMENT OF WORK

FOR

Office of Human Resource Management

Electronic Fingerprint Collection Process

Table of Contents

1. BACKGROUND

2. SCOPE

3. APPLICABLE DOCUMENTS

4. GENERAL REQUIREMENTS

4.1. CONTRACTOR FURNISHED EQUIPMENT

4.2. FINGERPRINT FACILITIES

5. TASKS

5.1. TASK 1 – REQUESTS FOR SERVICES

5.2. TASK 2 – SCHEDULING FINGERPRINTS

5.3. TASK 4 – PROCESSING AND SUBMITTING FINGERPRINT RESULTS

5.4. TASK 6 - WEB SERVICES AND DATA REPORTING REQUIREMENTS

6. DELIVERABLES

6.1. SECURITY DELIVERABLES

6.2. QUALITY CONTROL PLAN AND PERFORMANCE MEASURES

6.3. REPORTS

6.4. NON-DISCLOSURE AGREEMENT

6.5. SMALL AND SMALL DISADVANTAGED BUSINESS SUBCONTRACTING PLAN (IF THE CONTRACTOR IS A LARGE BUSINESS)

7. GOVERNMENT-FURNISHED INFORMATION AND EQUIPMENT (GFE/GFI)

8. TERM OF CONTRACT

9. PLACE OF PERFORMANCE

10. SECURITY

11. OTHER CONSIDERATIONS

11.1.TRANSITION PROCESS

11.2.HOURS OF OPERATION

11.3.MEETINGS AND TRAVEL

11.4.CONTRACTOR PERSONNEL

11.5.INVOICING

11.6. SECTION 508 REQUIREMENTS.……….…………………………………………………………………………………………………………………………….………………16

11.7. ENTERPRISE ARCHITECTURE COMPLIANCE……………………………………………………………………………………………………………………………………….17

11.8. INFORMATION TECHNOLOGY SECURITY AARENESS TRANING (JULY 2023) ……………………………………….……………………………………………………...19

1. BACKGROUND

1.1.1. As a component of the Department of Homeland Security (DHS), U.S. Customs and Border Protection

(CBP) is responsible for protecting our Nation’s borders in order to prevent terrorists and terrorist weapons from entering the United States, while facilitating the flow of legitimate trade and travel. CBP is also responsible for apprehending individuals attempting to enter the U.S. illegally; stemming the flow of drugs and other contraband; protecting our agricultural and economic interests from harmful pests and diseases;

protecting American business from theft of their intellectual property; and regulating and facilitating international trade, collecting import duties, and enforcing U.S. trade laws. The Office of Human Resources Management (HRM) CBP Hiring Center (HC) supports the recruitment, hiring, and retention of qualified employees for various positions within CBP.

1.1.2. All CBP employees, contractors, consultants, and applicants, are required to undergo a background investigation to include fingerprints that are required for a National Agency Check (NAC).

2. SCOPE

2.1.1. The purpose of this document is to provide the necessary requirements to procure automated electronic fingerprint services for all CBP employees, contractors, consultants, and applicants (hereafter referred to as “candidates”).

2.1.2. The Contractor shall provide all fingerprinting facilities, all fingerprinting personnel, electronic communications of all fingerprint data, and all equipment necessary for completing an automated electronic fingerprint process.

2.1.3. The Contractor shall provide the following services in compliance with this Statement of Work (SOW):

2.1.3.1. Provide a means to schedule all participants for fingerprinting in coordination with the Hiring Center (HC), the Office of Professional Responsibility (OPR) / Personnel Security Division (PSD), and the Office of Information and Technology (OIT) / Workforce Management Division (WMD) as requested by the Contracting Officer’s Representative (COR).

2.1.3.2. Provide an automated self-scheduling capability to allow candidates to elect date, time and location for the electronic collection of their fingerprints.

2.1.3.3. Capture the electronic fingerprints for all CBP candidates requiring fingerprints as part of their background investigation NAC requirements.

2.1.3.4. Maintain a web-based data system, accessible remotely by CBP personnel per the Web Services and reporting requirements in this SOW.

2.1.3.5. Ensure any and all data that is collected, generated, and/or tracked in the vendor system must be exposed for integration via web service(s) and are to include relationship and unique identifiers.

2.1.3.6. Provide all trained personnel to administer fingerprint functions at facilities nationwide as specified in this SOW. The Contractor shall provide the fingerprinting sites in each of the forty-eight (48) continental United States as well as Alaska, Hawaii, Washington, D.C., Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan.

2.1.3.7. The services under this contract are subject to the needs of the Government and to the availability of funds; the volume of electronic fingerprints ordered is contingent upon the number of new hires approved by Congress, current CBP employees (i.e. periodic investigations), contractors requiring reinvestigations, and specific hiring requirements. CBP shall make a good faith effort to keep the Contractor informed of anticipated or impending needs for services. The volume of requests sent by CBP to the Contractor shall vary widely by day – CBP may send up to several thousand requests in one day which shall be completed within the timelines specified in this SOW.

2.1.4. The vendor must provide a testing environment that mimics the current production environment. CBP will be going through multiple systems changes and expects additional changes in the near future. These changes must allow CBP to have a testing environment in order to ensure any updates made are functioning correctly with the interfaces prior to deployment.

3. APPLICABLE DOCUMENTS

3.1. Electronic fingerprints collected under this Contract shall be consistent with the requirements in this Statement of Work

3.1.1.1. Compliance with DHS Security Policy

All hardware, software, and services provided under this contract must be compliant with:

3.1.1.2. DHS 4300A Sensitive Systems Handbook – Version 13.1

3.1.1.3. U.S. Customs and Border Protection (CBP) Information Systems Security Policies and Procedures Handbook, CIS HB 1400-05D (Attachment A.1)

3.1.1.4. DHS Handbook for Safeguarding Sensitive Personally Identifiable Information https://www.dhs.gov/sites/default/files/publications/Handbook%20for%20Safeguarding%20Sensitive%20 PII_0.pdf

3.1.1.5. OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017 https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2017/m-17-12_0.pdf

3.1.1.6. U.S. Customs and Border Protection (CBP) Information Security Handbook, Office of Professional Responsibility (OPR), HB 1400-04A (Attachment A.2)

3.1.1.7. Privacy Act of 1974, 5 U.S.C. § 552a

https://www.govinfo.gov/app/details/USCODE-2010-title5/USCODE-2010-title5-partI-chap5-subchapII-sec552a

3.1.1.8. Occupational Safety and Health Act of 1970

https://www.osha.gov/laws-regs/oshact/completeoshact

4. GENERAL REQUIREMENTS

4.1. Contractor Furnished Equipment

4.1.1. Hardware: Console or desktop computer;

4.1.1.1. Camera;

4.1.1.2. Flatbed scanner;

4.1.1.3. Driver license reader;

4.1.1.4. Signature pad;

4.2. Fingerprint Facilities

4.2.1. The Contractor shall provide fingerprinting service in each of the forty-eight (48) Continental United

States and in Alaska, Hawaii, Washington DC, Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan. The Contractor shall provide fingerprint services within a sixty (60) highway-mile radius of the candidate’s zip code to meet CBP’s background investigation timeline and other requirements addressed in this SOW.

4.2.2. If the Contractor is unable to schedule an appointment within the required timelines because a facility is not available within a 60 (sixty) highway-mile commuting radius, the Contractor shall notify the COR within one (1) business day of the initial request for services from CBP. The Contractor shall then be provided two (2) additional business days to locate an acceptable facility.

4.2.2.1. If the Contractor is unable to locate an acceptable facility within the sixty (60) highway-mile radius, the Contractor shall obtain approval from the COR to arrange an alternative solution.

4.2.2.2. The Contractor shall ensure that all the fingerprint locations meet the requirements of the Occupational Safety and Health Act (see Applicable Documents in this SOW).

4.2.3. Fingerprint Facility Requirements

4.2.3.1. Any firm or business under contract with CBP that requires access to sensitive information must possess a facility security clearance commensurate with the level of access required.

This includes any firm or business entity that requires access to sensitive information to prepare a response to a request for proposal (RFP) or a request for bid and/or in performance of a sensitive contract.

https://cbpgov.sharepoint.com/sites/OIT/bems/wcr/sf/Documents/Forms/AllItems.aspx?id=%2Fsites%2FOIT%2Fbems%2Fwcr%2Fsf%2FDocuments%2FDHS%20Instruction%204300A%2C%20Version%2013%2E1%2C%20DHS%20Sensitive%20Systems%20SIGNED%2007%2D27%2D2017%2Epdf&parent=%2Fsites%2FOIT%2Fbems%2Fwcr%2Fsf%2FDocuments https://www.dhs.gov/sites/default/files/publications/Handbook%20for%20Safeguarding%20Sensitive%20PII_0.pdf https://www.dhs.gov/sites/default/files/publications/Handbook%20for%20Safeguarding%20Sensitive%20PII_0.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2017/m-17-12_0.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2017/m-17-12_0.pdf https://www.govinfo.gov/app/details/USCODE-2010-title5/USCODE-2010-title5-partI-chap5-subchapII-sec552a https://www.govinfo.gov/app/details/USCODE-2010-title5/USCODE-2010-title5-partI-chap5-subchapII-sec552a https://www.osha.gov/laws-regs/oshact/completeoshact

4.2.3.2. Firms that do not possess a facility security clearance, or the requisite level of facility security clearance, must be sponsored for a DHS facility security clearance when a determination has been made by the CBP program office that the contract effort will require access to sensitive information. CBP offices must submit relevant sponsorship requests for facility security clearances to OPR for processing.

5. TASKS

5.1. Task 1 – Requests for Services

5.1.1. On a daily basis, or more frequently when available, CBP shall send via Excel file or via web services information regarding requests for services to be completed. Specific data items included, and the format of this file shall be determined by CBP upon award of this contract. The file shall contain the following types of requests:

5.1.1.1. Fingerprint requirements;

5.1.1.2. Candidate’s contact information changes;

5.1.1.3. Cancellation of requests for candidates who are removed from the process.

5.1.2. Requests shall be rejected by the Contractor and not processed for the following reasons including, but not limited to:

5.1.2.1. Duplicate requirement requests from CBP candidates and,

5.1.2.2. Incorrect data formatting.

5.1.3. The Contractor shall provide a summary of requests processed and rejected within two (2) hours of receipt of the request. This summary shall include, at a minimum:

5.1.3.1. Number of fingerprint requests processed (i.e., contact information changes, and cancellation/ discontinuation of scheduling);

5.1.3.2. Number of fingerprint requests processed at each location;

5.1.3.3. Number of requests not scheduled or completed; and,

5.1.3.4. For rejected requests only:

5.1.3.4.1. Candidate’s name and CBP identification number.

5.1.3.4.2. Fingerprint date; and,

5.1.3.4.3. Reason for rejection.

5.2. Task 2 – Scheduling Fingerprints

5.2.1. The Contractor shall provide a standard script of language for use in the scheduling process to the

COR within fifteen (15) days of contract award. The script shall be approved by the COR prior to use.

5.2.2. The Contractor shall provide scheduling access to a web-based system on a 24 hour 7 days per week, 365 days per year basis.

5.2.2.1.1.1. The Contractor shall have the ability to provide an automated self-scheduling capability to allow candidates to elect date, time, and location for fingerprint collection and the ability for the candidate to cancel up to 24 hours prior to their appointment.

5.2.2.1.2. The system shall provide a way to communicate whether an appointment was cancelled by the candidate or by the Contractor,

5.2.2.2. In addition to the requirements above, standard script language shall include:

5.2.2.2.1.1. Instruction to the candidate as to the necessary items required for the fingerprint process.

5.2.3. The Contractor shall be notified by CBP on a daily basis via vendor provided web-based portal or electronic exchange/web services regarding the fingerprint requests to be scheduled or cancelled. The following data will be provided:

5.2.3.1. Candidate name, contact information (including up to three (3) phone numbers and one (1) email address), and current address for scheduling location purposes;

5.2.3.2. CBP’s fingerprint identification numbers, and candidate identification numbers (including CBP-specific candidate ID number and/or social security number);

5.2.3.3. Position; and,

5.2.3.4. Candidate address changes, and candidates that need to be removed from the scheduling process as they are no longer being considered for the position.

5.2.3.4.1.1. Candidates that are no longer being considered by, on contract with, or a current employee of CBP shall not be fingerprinted.

5.2.4. Within one (1) business day of receiving the fingerprint request, the Contractor shall identify the potential facility for the candidate to have their fingerprints captured and make the first contact attempt to schedule the process.

5.2.5. The Contractor shall provide the candidate with a unique barcode or ID number that they are expected to provide at their appointment along with two forms of government issued identification.

5.2.6. The Contractor shall use telephone/voicemail, email communication, and SMS text messaging when attempting to contact the candidate to schedule the fingerprint requirement.

5.2.7. Within three (3) business days of the initial request, the Contractor shall coordinate the scheduling of the fingerprints with the candidate and the facility to be administered as follows:

5.2.7.1. The Contractor shall offer fingerprint appointments at least five (5) days per week.

5.2.7.2. Fingerprinting shall be administered within ten (10) business days of the request from CBP.

5.2.8. If the Contractor is unable to schedule an appointment within the required timeline, the Contractor shall notify the COR within twenty-four (24) hours of making the determination via the Contractor’s web-based portal

5.2.8.1. “Hard to reach” candidates are individuals whom the Contractor has been unable to reach after a minimum of three (3) documented attempts, on three (3) separate days, using all telephone numbers and email addresses available. The Contractor shall not close requests for at least two (2) business days following the third attempt to contact the candidate.

5.2.8.1.1. The Contractor shall make a minimum total of three (3) contact attempts on three (3) separate days using all provided telephone numbers and email addresses. These contact attempts shall be made at different times of the day before identifying a candidate as “Hard to Reach.”

5.2.8.1.2. The Contractor shall make, at a minimum, one (1) contact attempt using each method of communication provided by CBP before identifying a candidate as “Hard to Reach.”

5.2.8.2. The Contractor shall inform the COR via web services when a requested service is unable to be scheduled. Notification shall be sent within twenty-four (24) hours of making the determination that the service cannot be scheduled. The reasons for failure to schedule a service shall be clearly documented. Examples include: refusal to schedule; candidate is unable to complete fingerprinting within the specified time frame; candidate is “Hard to Reach”; candidate is no longer interested in the position, is on leave, or is on Temporary Duty Assignment (TDY).

5.2.9. Within twenty-four (24) hours of scheduling the appointment, the Contractor shall send the candidate an email providing the appointment information, facility location, and any items the candidate is required to complete and bring to the appointment. The Contractor’s standardized email language shall be provided to the COR within ten (10) business days of award and shall be approved by the COR prior to use.

One (1) business day prior to the appointment date, the Contractor shall send the candidate a reminder email and SMS text message providing, at a minimum, the scheduled appointment information, facility location, and a reminder to bring the unique barcode or ID number that was provided by the Contractor to their appointment along with two forms of government issued identification. The email language/text message shall be provided to the COR during transition in and shall be approved by the COR prior to use.

If the candidate does not attend the scheduled appointment without prior notification to the Contractor, the candidate is deemed a “No Show.” At the time, the Contractor documents the No Show in the Contractor’s automated system, an email shall be sent to the candidate providing instructions to contact HC for applicants and OPR for candidates due to the No Show. The email language shall be provided to the COR during transition in and shall be approved by the COR prior to use.

5.3. Task 4 – Processing and Submitting Fingerprint Results

5.3.1. The Contractor shall provide a mechanism whereby CBP can retrieve the electronic fingerprint file in

CBP’s prescribed file format for processing and forwarding to the Office of Personnel Management (OPM) or the Defense Counterintelligence and Security Agency (DCSA):

5.3.1.1. The Contractor shall provide a web service delivered document indicating the number of fingerprints transmitted to the delegated system on a daily basis.

5.3.2. All documentation shall be forwarded electronically to CBP via web services as soon as submitted to the delegated system without error and confirmation of receipt has been received.

5.3.3. Electronic Fingerprint files, along with all associated candidate data, shall be available via the Contractor’s automated system within one (1) business day of the capture date.

5.3.4. The Contractor shall retain electronic copies of all fingerprint files to the extent required to comply with this SOW’s document retention requirement.

5.4. Task 6 - Web Services and Data Reporting Requirements

5.4.1. The Contractor shall maintain a web-based data system, accessible remotely by CBP personnel that enable the user to chronicle all attempted and actual communication between the Contractor and the candidate, as well as fingerprint status. The data system shall have the capability to allow the Contractor to input candidate information and date of fingerprint capture, and for CBP to retrieve those results. Additionally, the system shall have the capability to produce ad hoc, weekly, and monthly reports for capturing the status of fingerprint capture and scheduling status.

5.4.2. The Contractor shall electronically exchange fingerprint status with CBP. Data sent via web services and in the web portal shall be in real-time. This electronic exchange of fingerprint information includes

5.4.2.1. All scheduling data;

5.4.2.2. Appointment attendance data;

5.4.2.3. Fingerprint capture data;

5.4.2.4. CBP ability to request an additional scheduling attempt;

5.4.2.5. CBP ability to authorize the release of fingerprints to OPM;

5.4.2.6. Billing information;

5.4.3. The Contractor shall encrypt all Personally Identifiable Information (PII) information prior to sending to CBP via email. CBP shall approve the encryption prior to use according to encryption guidelines.

5.4.4. The Contractor shall maintain an automated database system accessible remotely by the COR and authorized CBP employees which permits access to specific information about each fingerprint request received by the Contractor from CBP. The information available shall include:

5.4.4.1. The current status of a fingerprint requirement at any time and the dates that key events occurred in the process to include but limited to;

5.4.4.1.1.1. The date the fingerprint appointment was requested

5.4.4.1.1.2. The date the fingerprint appointment was completed

5.4.4.2. Date fingerprinting was requested;

5.4.4.3. Candidate contact information used by the Contractor (including phone numbers, email address, zip code, and any other contact information used in the scheduling process);

5.4.4.4. Correspondence with the candidate (including contact attempts by the Contractor to the candidate, date calls were returned by the candidate, date materials/forms were sent to candidate, etc.);

5.4.4.4.1.1. Appointment date and time;

5.4.4.4.1.2. Verification of appointment attendance;

5.4.4.4.1.3. “Hard to Reach” or “No Show” designations as applicable;

5.4.4.4.1.4. CBP identification numbers associated with the fingerprint requirement; and,

5.4.4.4.1.5. Any other data items that provide information on the status of the request.

5.4.5. The Contractor’s database system shall have the capability of transmitting all fingerprinting information via Web Services and allow all information to be uploaded into CBP’s automated systems daily.

5.4.6. The Contractor's database shall be accessible to the COR or other designated authorized CBP personnel to query as needed.

5.4.7. The technical and security requirements of Web Services are discussed in the Security section of this

SOW.

6. DELIVERABLES

6.1. Security Deliverables

6.1.1. See Security section of this SOW for more detail on these documents. The following shall be submitted to the COR within 30 days of contract award (initial report), and throughout the life of the contract as stated in the table below:

Deliverable Delivery/Frequency Contingency Plan Initial and updates when changes to policy occur.

Incident Response Plan Initial and updates when changes to policy occur.

Security Assessments, Reviews and Reporting

Initial and annual assessments of security controls due at the beginning of each performance period.

Vulnerability Scanning Monthly scanning of systems and providing resulting audit reports.

6.1.2. Quality Control Plan (QCP)

6.1.2.1. Performance measures are based on the services required by this SOW and all attached documents.

See below chart that includes but is not limited to the performance measures for this contract:

Performance Measures Chart

1. Provide facilities equipped for capturing electronic fingerprints in the forty-eight (48) continental

United States as well as Washington, DC; Alaska; Hawaii; Puerto Rico; U.S. Virgin Islands;

Guam; and, Saipan

2. Complete fingerprinting requirement within sixty (60) highway-mile radius of a candidate’s address.

3. Each facility meets minimum specification requirements set forth in the SOW.

4. Process electronic scheduling requests in accordance with the SOW.

5. Schedule a varying volume of requirements within the timeframes required in the SOW

6. Provide, maintain, and protect from disclosure a data system accessible remotely by CBP to request, track, manage, and deliver electronic fingerprint data in accordance with the SOW.

7. Provide web services according to the data and reporting requirements of the SOW.

8. Ensure appropriate security of IT resources that are developed, processed, or used under this

Contract in accordance with the SOW.

9. Adhere to the Contractor’s Transition Plan.

10. Perform all services at the acceptable quality level by the end of the transition period as described in this SOW.

11. Assign key personnel that meet the required qualifications of the SOW

12. Provide sufficient non-key personnel as required

13. All personnel perform duties and complete tasks as required in this SOW

14. Adhere to the Contractor’s Quality Control Plan, meet performance measures and acceptable quality levels as required, and meet or exceed the minimum QCP requirements of the SOW.

15. If applicable, adhere to the plan that has been agreed upon by CBP for subcontracting with small and small disadvantaged businesses, in accordance with the Subcontracting Plan Outline and established procedures to monitor and control the subcontracting effort.

6.1.2.2. The acceptable quality level for this contract is 95% - all contract information and fingerprint administration services from the Contractor shall be at least 95% accurate. The Quality Control Plan shall include measures (see chart above) for the Contractor to achieve all performance goals. The

Contractor shall be responsible for the quality and timely completion of all Contract services.

6.1.3. The Contractor’s Quality Control Plan shall include

6.1.3.1. All items addressed in the Performance Measures Chart in this SOW;

6.1.3.2. Monitoring the performance of all subcontractors, including:

6.1.3.2.1. Process for identifying and correcting errors/ deficiencies and an error rate not to exceed five

(5) percent for work completed by subcontractor(s);

6.1.3.2.2. Verifying the qualifications and training of all staff;

6.1.3.2.3. Monitoring pending fingerprint requirements and follow-up to ensure the completion of services within required timeframes; and,

6.1.3.2.4. Verifying candidate attendance at scheduled appointments and ensuring that what is reported back to the Contractor from the subcontractors is accurate.

6.1.3.3. Monitoring the primary Contractor’s performance (including Key Personnel);

6.1.3.4. Contingency plan(s) for emergency operations when the Contractor's and/or subcontractor's services are impacted by natural disasters, severe weather, pandemics, etc.;

6.1.3.4.1. Contingency plan(s) for loss of information and security breach;

6.1.3.4.2. Detailed Plan for adhering to required deadlines; and,

6.1.3.4.3. The Contractor’s security procedures.

6.1.3.4.4. Detailed procedures to review and correct data entry errors in automated systems.

6.1.3.4.5. Systems to review all information for completeness and accuracy prior to submission to CBP.

6.1.4. Monthly teleconference meetings with the Contractor shall be scheduled to discuss quality control and performance issues.

6.1.4.1.1. The Contractor shall resolve any issues in accordance with this SOW.

6.1.4.1.2. The Contractor’s quality control effectiveness shall be noted in the annual performance evaluations.

6.1.5. Reports

6.1.6. The Contractor shall submit all reports to the COR within three (3) business days of the request unless otherwise specified in this SOW.

6.1.7. All reports shall be written to CBP's specifications and shall be provided electronically via the Contractor’s automated database system and a format prescribed by CBP. The Contractor shall retain electronic copies of all data to the extent required to comply with this SOW’s document retention requirement.

6.1.8. The Project Status Report shall be provided no later than the tenth (10) day of each month containing data from the previous month. This report shall also be provided ad hoc with updated data for a given date range as requested by the COR. The report shall include, at a minimum, the following information separated by position for the given reporting period:

6.1.8.1. Status of all fingerprints for all candidates.

6.1.8.2. A total number of fingerprints captured per date, and the cumulative number of requests ordered for the given reporting period;

6.1.8.3. Total number of fingerprints captured per date, and the cumulative number of requests completed for the given reporting period;

6.1.8.4. Number of fingerprints invoiced;

6.1.8.5. Number of fingerprints closed without invoicing due to inability to contact the candidate(s) (“Hard to Reach”);

6.1.8.6. Number of fingerprints closed without invoicing due to the candidate(s) failure to attend their appointment (“No Show”);

6.1.8.7. Number of fingerprints closed without invoicing for other reasons;

6.1.8.8. Complaints received from candidates (include type of complaint and facility) and final resolutions; and,

6.1.8.9. Number of fingerprints (s) that have been ordered but not billed (i.e., “open” requests).

6.1.9. The Contractor shall provide additional ad hoc reports as requested by the COR. If the need for a particular report becomes frequent, the report shall be available on an ongoing basis.

6.2. Other Deliverables|

6.2.1. Scheduling scripts; and,

6.2.2. Standardized email.

6.3. Small and Small Disadvantaged Business Subcontracting Plan (if the Contractor is a Large Business)

6.3.1. The Contractor shall submit:

6.3.1.1. A plan for subcontracting with small and small disadvantaged businesses that meets or exceeds CBP subcontracting goals listed in the Subcontracting Plan Outline.

6.3.1.2. An outline of procedures to monitor and control the subcontracting effort.

6.3.2. Award will be conditioned upon the Government's ability to reach an agreement with the Contractor on the terms of its subcontracting plan. If the Government accepts the Contractor’s subcontracting plan, it will become a part of this contract. Use of the Subcontracting Plan Outline provided by CBP is optional;

however, the plan shall contain all elements included in the outline. The Contractor's subcontracting plan will be evaluated in the Government's determination of the Contractor’s capability. Past performance against historical goals and the small, disadvantaged business participation factor shall also be evaluated.

7. GOVERNMENT-FURNISHED INFORMATION AND EQUIPMENT (GFE/GFI)

7.1.1. There is no Government Furnished Equipment for this contract. All Contractor equipment is subject to the requirements outlined in Section 10, Security.

7.1.2. The Government shall provide contact information of candidates and location of candidates for scheduling purposes.

8. PLACE OF PERFORMANCE

8.1.1. The Government shall not provide the Contractor with a work site(s). The Contractor’s administrative/business office shall be at any location in the United States; only the facilities performing the services shall be located in relation to the candidate’s work/home address.

8.1.2. The Contractor shall provide the fingerprinting sites in each of the forty-eight (48) continental United States as well as Alaska, Hawaii, Washington, D.C., Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan.

9. SECURITY

9.1.1. Contractors are fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance).

9.1.2. Contractors have a responsibility to protect the information they possess and process; and to ensure that security of the information in their charge, contractors must adhere to the same rules and regulations as Government employees.

9.1.3. All services provided under this contract must be compliant with DHS Information Security Policy, identified in DHS Directive140-01, Information Technology Security Program and 4300A Sensitive Systems Handbook.

9.2. Security Clearances: Personnel Security Background Data

9.2.1. Performance under this contract is considered sensitive but unclassified and a security clearance is not required.

9.3. Security Requirements for Unclassified Information

9.3.1. The Contractor shall ensure that all information obtained in this Contract remains confidential and is not disseminated outside of CBP. All contract documents, records, and Personally Identifiable Information shall be stored in a CBP approved secured locked, fireproof filing cabinets and in a secured room that is not accessible to the public or visitors. The Contractor shall take necessary precautions to ensure that all additional information is properly secured to prevent unauthorized access at all times. The Contractor shall comply with the DHS Handbook for Safeguarding Personally Identifiable Information as amended.

9.3.2. Sensitive Personally Identifiable Information (PII)

Sensitive PII information shall be provided to Contractor by the Government during this contract. When a Contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractor shall Accredit (ATO) this information system to the (HHM) FIPS level. The Contractor and subcontractors shall have access to PII such as subject’s names, addresses, telephone numbers, e-mail addresses, date of birth, etc. Only the Contractor and its subcontractors with authorization and only on a need-to-know basis shall access this information. All Sensitive PII Information shall be stored in accordance with requirements by Office of Professional Responsibility (refer to HB 1400-05D attachment). The Sensitive PII information shall be transmitted electronically and encrypted as required in this SOW.

9.4. Contingency and Incident Response Plans

9.4.1. All plans are created in accordance with the requirements identified in the DHS/CBP Security documentation, and the guidelines from the National Institute of Standards and Technology (NIST). NIST documentation can be found at: http://csrc.nist.gov/publications

9.4.1.1. Contingency Plan

9.4.1.1.1. Contingency plans provide guidance on the interim measures to recover information system services after a disruption and may include the relocation of information systems and operations to an alternate site, recovery of information system functions using alternate equipment or the performance of information system functions using manual methods. The Contractor shall provide a plan that contains the detailed guidance and procedures for restoring a damaged system based on the impact levels and recovery requirements.

9.4.2. Incident Response Plan

9.4.2.1. Incident Response plans provide guidance on the appropriate procedures and responses to an incident and the capabilities required to successfully, efficiently, and effectively handle an incident. It encompasses all actions taken to quickly restore normal IT service and to minimize impacts on business operations.

9.4.2.2. The Contractor shall ensure that all privacy and computer security incidents are identified, reported, and appropriately responded to, in order to mitigate harm to DHS/CBP assets, information, and personnel. Privacy incidents must be reported to the CO and COR as soon as possible, but no later than within one hour of recognition that a privacy incident occurred.

All privacy incidents must be reported whether or not they involve information resources.

9.5. Security Breach

9.5.1. If a security breach occurs, in accordance with the Contractor’s Incident Response Plan, the Contractor shall notify the CO and COR within one business day of recognition that a security breach occurred. Within five (5) additional business days the Contractor shall issue and provide a report to the COR and CO detailing the research conducted by the Contractor, conclusions, and preventive measures that will be taken going forward. The Contractor shall also notify the affected candidates and provide the list of those affected to the COR along with copies of the notification from the Contractor to the affected candidates. The Contractor shall provide identity and credit monitoring services to the affected candidates for no less than 18 months.

9.6. Document Retention

http://csrc.nist.gov/publications

9.6.1. The Contractor shall maintain electronic copies of the associated documentation until OPR confirms receipt and completeness of the records. The Contractor shall delete their copies 90 days after receipt. This is in compliance with General Records Schedule 4.2, item 130. Formal contract closeout shall include the CBP Office of Information Technology overseeing the Contractor destroying all data, as required by CBP regulation, which was obtained and retained per this contract.

9.7. Contractor Representation

9.7.1. In correspondence, all Contractor and subcontractor employees must identify themselves as contractors and subcontractors operating on behalf of CBP. E-mail signatures must contain: the Contractor name; Contractor company; CBP title, program, and organization; CBP program office;

CBP identifier, contact number; and fax number if applicable. A sample of the formatting will be provided by the COR.

9.8. Security Assessments, Reviews and Reporting

9.8.1. Security is an integral element in the management of this contract. The Contractor shall conduct assessments, reviews and report the status of the implementation and enforcement of the security requirements contained in this contract.

9.8.2. The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford the Office of the CBP Chief Information Security Officer (CISO) and/or representatives of the CISO, access to the Contractor’s (and subcontractor’s) facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

9.9. Web Services

9.9.1. The system or application delivered by the Contractor shall provide Web Services functionality (in accordance with Federal security and privacy guidelines) that shall allow for the exchange or sharing of functions and data within its system to and from DHS and CBP owned or contracted systems.

9.9.2. Data file transfers shall be performed through TLS Secured HTTP downloads from an authenticated website upon award and during the setup and testing of the web services. The file formats will be specified by CBP.

9.9.3. Authorization from CBP shall be granted before sending any miscellaneous documentation that needs to be submitted to CBP outside of a web service interface (i.e. via e-mail).

9.9.4. Data input into Contractor systems are owned by DHS and CBP and must be delivered upon demand or at the termination of the contract, in an electronic file format specified by CBP. Upon the completion or termination of a contract and delivery of DHS’/CBP’s data as described, Contractors are required to destroy their local copies of the data upon approval by CBP.

9.9.5. Web Services Requirements

9.9.5.1. The Contractor shall complete all electronic data transfers using web services. This requirement applies to both data provided to and from CBP.

9.9.5.2. Any and all data that is collected, generated, and/or tracked in the vendor system, must be exposed for integration via web service(s) and are to include relationship and unique identifiers.

9.9.6. Technical Requirements of Web Services

9.9.6.1. All Contractor supplied data shall be made available via secure web services, including invoices.

This data shall be accessible via a single web service that returns data in an agreed upon XML format. The web service shall accept filter criteria such as an effective date.

9.9.6.2. CBP and the Contractor will define the data needed to be exchanged or shared, the data file formats, the web services exchange mechanism and Application Program Interfaces (APIs) and architecture, as well as the periodicity (up to and including instantaneous, bi-directional data feeds between the Contractor system and CBP systems or databases).

9.9.6.3. Data requirements will change over time, but changes will not exceed four (4) times in a calendar year. The Contractor shall be required to modify their systems to be compliant with CBP changes, within thirty (30) calendar days of being notified of the change(s).

9.9.6.4. Data file transfers shall be performed through TLS Secured HTTP downloads from an authenticated website upon award and during the setup and testing of the web services. The file formats will be specified by CBP.

9.9.6.5. The Contractor’s web service shall conform to the following technical requirements:

10.15.6.5.1. The web service shall be WS-I Basic Profile 1.1 compliant;

10.15.6.5.2. The web service shall be secured via TLS and AES-256 bit encryption;

10.15.6.5.3. The web service shall provide an authentication mechanism that ensures only authorized requests are processed;

10.15.6.5.4. The web service shall execute requests within one second;

10.15.6.5.5. The web service shall execute against and return current, up to date data;

10.15.6.5.6. The web service shall be available for use at all times, 24 hours per day, seven days per week;

10.15.6.5.7. The Contractor shall submit a detailed description of its web service using a standard WSDL x document;

10.15.6.5.8. The Contractor shall provide an XML schema to describe the result set returned by the web service;

10.15.6.5.9. The Contractor shall provide detailed explanation for any error condition that may be raised as a result of web service operation;

10.15.6.5.10. The Contractor shall provide a list containing all possible error codes and a detailed description of each error; and

10.15.6.5.11. The Contractor shall provide end use documentation for its web service.

9.9.7. Web Services Expectations

10.15.7.1 The Contractor shall obtain and adhere to detailed requirements that define:

10.15.7.1.1. Web Service method signatures

10.15.7.1.2. Input Parameters (filter criteria)

10.15.7.1.3. Output fields

10.15.7.1.4. XML Schema of the results set returned by web service; and

10.15.7.1.5. Any additional business rules

10.15.7.2. CBP shall be given the opportunity for acceptance testing of the Contractor provided web service.

10.15.7.3. The COR shall be notified a minimum of two weeks prior to any modifications made to the web service; final approval by the COR shall be required before implementation.

10.15.7.4. All production versions of the deployed web service shall be available in production and removed only upon request from CO or with CBP’s explicit permission.

10.15.7.5. The COR shall be notified at least 24 hours in advance of any web service maintenance that shall require web service down time. During downtime, fingerprint results shall still be made available to the COR in an agreed method. The method shall be agreed upon after award, during initial transition meetings.

10.15.7.6. The Contractor’s web service support shall have a response time of 24 hours or less; however, the Contractor’s web service support personnel do not need to be available 24 hours per day, seven

(7) days per week.

10.15.7.7. Safeguards shall also be put in place to protect the PII.

10. OTHER CONSIDERATIONS

10.1. Transition Process

10.1.1. The transition period shall begin once the contract is awarded and shall be completed no later than 60 days after the award. After the transition period, the Contractor shall be fully capable of executing all services required in this SOW. Once ordering starts, CBP may continually request fingerprints without breaks in ordering, subject to hiring requirements and the availability of funds.

10.1.2. The Contractor shall complete the following during the transition period:

10.1.2.1. Performing personnel security clearances to the extent required by this SOW;

10.1.2.2. Training all facilities and administrators performing the fingerprint process;

10.1.2.3. Testing and modification as necessary of automated database system;

10.1.2.4. Testing and modification as necessary files for web services data transfers;

10.1.2.5. Testing and modification as necessary files for electronic invoices;

10.1.2.6. Review and acceptance of all standardized materials received from authorized CBP staff;

10.1.2.7. An overview of all reports the Contractor has available for the Government; and

10.1.2.8. Access for all authorized CBP personnel to the Contractor’s remotely-accessible automated database system and any secure e-mail systems, etc. The COR shall provide information on CBP personnel that shall be granted this access.

10.2. Hours of Operation

10.2.1. The Contractor’s customer service representatives, involved in scheduling fingerprints, shall be available from at least 9:00 am to 5:00 pm Eastern Time Monday through Friday, except on Federal holidays.

10.2.2. Fingerprinting shall be conducted at least five (5) days per week. The Contractor shall provide the COR with contact information, including the telephone numbers of the Program Manager, and relevant corporate personnel before, during, and after business hours.

10.3. Meetings and Travel

10.3.1. The Contractor shall be responsible for all travel required in completing this Contract. This includes travel costs associated with establishing facilities, training and attending meetings.

10.3.2. Quarterly meetings with the Contractor shall be scheduled to discuss overall contract quality control and performance issues as well as other items deemed appropriate to the Government.

10.3.3. More frequent meetings may be required to address general contract issues, modifications, or other items deemed appropriate by the Government and/or Contractor.

10.3.4. Meetings may occur either by telephone or teleconference

10.4. Contractor Personnel

10.4.1. Key Personnel - Program Manager

10.4.1.1. The Contractor shall designate a Program Manager to serve as the main point of contact for this contract and shall designate individuals to serve as back-up to cover absences.

10.4.1.2. The Program Manager shall possess a minimum of three (3) years of experience supervising and managing staff. The Program Manager shall also have a minimum of two (2) years of experience working in a fingerprinting or security clearance related program.

10.4.1.3. The Program Manager shall be responsible for the following items:

10.4.1.3.1. Ensure the Contractor has sufficient number of fingerprint sites and trained administrators.

10.4.1.3.2. Conducting training and quality assurance facility visits to all approved sites.

10.4.1.3.3. Ensure all candidate complaints are fully addressed and resolved in coordination with the COR.

10.5. Pre-employment Services Invoicing Requirements

10.5.1. General Invoicing Requirements: Electronic Invoicing – Invoice Processing Platform

(IPP)

10.5.1.1.1. The Contractor shall submit electronically through the U.S. Department of

Treasury’s IPP an invoice for the services rendered the previous month. The Contractor shall document on each invoice, the specific month and the year for which payment is being requested.

10.5.1.1.2. In order to avoid invoice rejections, the Contractor’s finance department shall send an advance copy, in an agency compatible format and software (e.g. Microsoft Word, Excel, .PDF) as prescribed by CBP, to the COR/s for reconciliation prior to submission.

10.5.1.1.3. All corrected invoice cover sheets shall have the invoice date corrected to show the date the correction is submitted.

10.5.1.1.4. The Contractor shall invoice only for fingerprints completed and received by CBP and shall certify that the costs in the invoice are accurate and complete.

10.5.1.1.5. The Contractor is required to provide a report within each invoice that separates the quantity and price of services being billed for each applicant/candidate/employee category. Each category on the report shall list all service types and the respective quantity. If the Contractor has questions regarding which candidates should be included in a billing category, the COR shall provide the information. The category report shall include the following distinctions:

10.5.1.1.5.1. Employee

10.5.1.1.5.2. Contractor

10.5.1.1.5.3. Applicant

10.5.1.1.6. The Contractor shall retain electronic copies of all invoices through the end of the contract.

10.5.1.1.7. The Contractor shall invoice services based on the date which the services were requested. CBP shall not be invoiced for services that are performed incorrectly, or have other Contractor uncorrectable error scenarios as previously outlined in this

SOW.

10.5.1.1.8. Initial acceptance shall occur when the COR certifies the invoice.

10.5.1.1.8.1. If defects in the products provided by the Contractor are found after certification of the invoice, the Contractor shall be required to re-perform the service or complete the service as originally required at no additional cost to the Government.

10.5.1.1.8.2. Defects may include but not be limited to items such as failure to transmit to CBP or missing information.

10.5.1.1.9. In the event these items are discovered, the Contractor is required to complete unfinished items or re-work by scheduling any necessary appointments related to the deficiency and take any other actions necessary to complete the collection per the contract requirements.

10.5.1.1.10. If it is discovered that staff was not correctly performing the requirements, the Contractor shall complete re-work unless otherwise notified by the COR, at no cost to the Government.

10.5.1.1.11. Re-work of services is required to be completed as soon as possible. Unless otherwise stated in this SOW, any appointments needed for re-work must be scheduled within five (5) business days of notification to the Contractor of the deficiency or later if the candidate is not available for appointments until a later date.

10.5.1.1.12. The COR shall be notified of the rescheduled appointment(s) information. The final product of the re-work must be completed and returned to CBP within two

(2) business days of the appointment.

10.5.1.2. Technical Invoicing Requirements

10.5.1.2.1. Each invoice cover sheet submitted by the Contractor shall include but not be limited to:

10.5.1.2.2. The Contractor shall submit monthly invoice statements which include the following:

10.5.1.2.2.1. Unique Invoice number

10.5.1.2.2.2. Invoice Date

10.5.1.2.2.3. Type of service performed: Fingerprinting

10.5.1.2.2.4. Number of fingerprints captured for each line item and the dollar amount for each fingerprint capture

10.5.1.2.2.5. Cumulative dollar amounts for each line item

10.5.1.2.2.6. Name of the candidate

10.5.1.2.2.7. CBP Candidate ID number

10.5.1.2.2.8. Location of facility/facility number

10.5.1.2.2.9. Price of services performed

10.5.1.2.2.10. Date the service was requested

10.5.1.2.2.11. Date the results were sent to CBP

10.5.1.2.2.12. Contract number and Task Order/Purchase Order number

10.5.1.2.2.13. Name and address of the contracting official…